Privacy Policy

1. Who we are

AI METABOLICA (“the Service”, “we”, “us”) is operated by VLCroup, LLC (a Delaware limited liability company) (“the Company”, “Controller”), State of Delaware, United States of America, registered address 1145 East 7th Street, Wilmington, DE 19801, United States. Contact: nnt2025@proton.me.

AI METABOLICAis an AI nutrition companion: a food diary, photo-based food recognition, an AI chat and voice assistant (“Margarita”), a calendar, a menstrual-cycle tracker, body-progress photos, and a community feed.

2. Scope and legal bases (GDPR)

We process personal data under the following legal bases (Art. 6 GDPR):

• Consent (Art. 6(1)(a)) — for analytics cookies, marketing communications, and for special-category health data (see §4), where consent is the basis required by Art. 9(2)(a) GDPR.
• Contract (Art. 6(1)(b)) — to create your account, operate core Service features, and process your subscription.
• Legitimate interests (Art. 6(1)(f)) — for fraud prevention, service security, and product analytics, balanced against your rights.
• Legal obligation (Art. 6(1)(c)) — tax, accounting, and consumer-protection record-keeping.

3. Data we collect

• Account data — email, name (optional), authentication identifiers.
• Profile data — age, sex, height, weight, activity level, goals, profile photo (optional).
• Nutrition data — meals, food photos, macros/calories, meal timestamps.
• AI interaction data — chat messages, voice recordings and their transcripts, assistant history.
• Health data (special category) — menstrual-cycle entries, body-progress photos and body measurements. Collected only after a separate, explicit opt-in consent (see our Health Data Consent notice) and never required to use the core Service.
• Payment data — subscription plan, billing history and status. Card details are entered directly with Stripe and never touch our servers.
• Technical data — IP address, device/browser type, OS, cookies, local storage, usage/analytics events.

4. Special category data (health)

Menstrual-cycle information and body-progress photos are “data concerning health” under Art. 9 GDPR. We only collect them with your explicit, separate consent, obtained through an in-app consent screen distinct from account registration. You may withdraw this consent at any time from Profile settings; withdrawing disables the related feature but does not affect the lawfulness of processing before withdrawal.

5. How we use your data

• Operate the food diary, AI photo recognition, chat/voice assistant, calendar, and community feed.
• Personalize nutrition guidance and progress tracking.
• Process payments and manage subscriptions.
• Send service notifications (renewal, feature updates) and respond to support requests.
• Detect fraud, secure the Service, and comply with legal obligations.
• Product analytics to improve the Service (only with consent for non-essential analytics cookies — see our Cookie Policy).

We do not sell personal data.

6. Subprocessors and recipients

Each subprocessor below is bound by a data-processing agreement or equivalent contractual safeguards and may only use your data to provide the service on our behalf.

7. International transfers

Where personal data is transferred outside the European Economic Area (e.g., to subprocessors in the United States), we rely on the EU Standard Contractual Clauses, an adequacy decision, or another lawful transfer mechanism, and apply supplementary safeguards where required.

8. Data retention

• Active accounts — retained while you use the Service.
• Inactive accounts — deleted after 3 years of inactivity.
• Deleted accounts — personal data erased within 30 days, except data we must keep to comply with law (e.g., billing records).
• Financial records — retained for the period required by applicable tax law.
• Health data (§4) — deleted immediately upon consent withdrawal or account deletion, whichever is earlier, subject to the exceptions above.

9. Your rights

Subject to applicable law (GDPR for EEA/UK residents; see §11 for California), you have the right to:

• Access a copy of your personal data.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”).
• Restrict or object to processing.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email nnt2025@proton.me. We respond within 30 days.

10. Children

The Service is not directed to and may not be used by anyone under 16 years old. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us for prompt deletion.

11. California residents (CCPA/CPRA)

California residents have the right to know what personal information we collect, request deletion, and opt out of the “sale” or “sharing” of personal information (as those terms are defined by the CCPA/CPRA). We do not sell personal information. To exercise your CCPA/CPRA rights, email nnt2025@proton.me.

12. Security

We use encryption in transit (TLS) and at rest where applicable, access controls, and regular reviews of our subprocessors’ security practices. No system is completely secure; we cannot guarantee absolute security.

13. Changes to this Policy

We may update this Policy. Material changes are notified by email or an in-app notice. Continued use of the Service after changes take effect constitutes acceptance.

14. Contact